-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathtm-list.php
138 lines (104 loc) · 4.04 KB
/
tm-list.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
<?php
# TM-LIST web UI script for display IOC from Apex central and DSM
$file_apex="/var/www/MISP/PyMISP/examples/list_apex_so.txt";
$file_ds="/var/www/MISP/PyMISP/examples/list_ds_so.txt";
$return_all_apex = json_decode(file_get_contents($file_apex));
$return_all_ds = json_decode(file_get_contents($file_ds));
$show = "<br>APEX IOC list was last modified: " . date ("F d Y H:i:s.", filemtime($file_apex)+18000)."<br>";
$show .= "Deep Security IOC list was last modified: " . date ("F d Y H:i:s.", filemtime($file_ds)+18000)."<br>";
print("<html><head><title>TM-MISP Integration Portal</title>
<meta charset='UTF-8'>
<meta name='viewport' content='width=device-width, initial-scale=1'>
<link rel='stylesheet' type='text/css' href='main.css'>
</head><body><script type='text/javascript'>
function loadVT(url_1,myDiv)
{
var xmlhttp;
if (window.XMLHttpRequest)
{// code for IE7+, Firefox, Chrome, Opera, Safari
xmlhttp=new XMLHttpRequest();
}
else
{// code for IE6, IE5
xmlhttp=new ActiveXObject('Microsoft.XMLHTTP');
}
xmlhttp.onreadystatechange=function()
{
if (xmlhttp.readyState==4)
{
tmp=xmlhttp.responseText.split('===');
document.getElementById(myDiv).innerHTML=tmp[1];
document.getElementById('f_'+myDiv).innerHTML=tmp[0];
}
}
xmlhttp.open('GET','tm-misp.php?url='+url_1+'&div='+myDiv,true);
xmlhttp.send();
}
</script>
<div class=limiter><div class=container-table100>");
//--------------------------------
print(" <div class=wrap-table100><br><br></div><div class=wrap-table100><h1>IOC List from MISP in Trend Micro <h3>[ <a href='tm-misp.php'>see MISP Waiting List IOC</a> ]$show</h3></h1></div>
<div class=wrap-table100>
<div class=table100>
<table><thead>
<tr class=table100-head><th class=column1>#</th><th class=column2>SHA256</th><th class=column3>SHA-1 / URL / Domain / IP</th><th class=column4>FileName</th><th class=column6>VirusTotal </th></tr></thead><tbody>
");
$t=0;
$x=0;
$a=Array();
if(is_object($return_all_apex)){
foreach ($return_all_apex as $apex_key => $apex_value){
if(count($apex_value)<2){
break;
}
for ($i=0;$i<count($apex_value);$i++){
#print_r($apex_value[$i]);
#print("<hr>");
foreach($apex_value[$i] as $afield_name => $afield_value){
if($afield_name === "content"){
$aname_print=$afield_value;
}
if($afield_name === "notes" && preg_match("/MISP/",$afield_value)){
$t++;
array_push($a,strtolower($aname_print));
#print "<p>$t. $aname_print</p>";
}
}
}
}
}
$return_all_rule=$return_all_ds;
$k=0;
foreach ($return_all_rule as $globalrule => $array_of_rule){
for ($i=0;$i<count($array_of_rule);$i++){
foreach($array_of_rule[$i] as $field_name => $field_value){
if($field_name === "sha256"){
$name_print=strtolower($field_value);
}
if($field_name === "description" && preg_match("/MISP/",$field_value)){
$k++;
$name_print2="";
$tmp=explode("=",$field_value);
if(count($tmp)>1){
$name_print2 = $tmp[1];
$a = array_diff($a, array($tmp[1]));
}
$vt_link=$name_print;
print("<tr><td class=column1>$k.</td><td class=column2>$name_print</td><td class=column3>$name_print2</td><td class=column4><div id=f_myDiv".($k)."> </div></td><td class=column6 nowrap><div id=myDiv".($k)."><a href='#' onclick=loadVT('$vt_link','myDiv".($k)."')>View VT</a></div></td></tr>");
}
}
}
}
$a = array_merge($a);
#print_r($a);
for($w=0;$w<count($a);$w++){
print("<tr><td class=column1>".($k+$w+1).".</td><td class=column2></td><td class=column3>$a[$w]</td><td class=column4><div id=f_myDiv".($k+$w+1)."> </div></td><td class=column6 nowrap><div id=myDiv".($k+$w+1)."><a href='#' onclick=loadVT('$a[$w]','myDiv".($k+$w+1)."')>View VT</a></div></td></tr>");
}
print("<tr><td class=column1>>>></td><td class=column2>Deep Security IOC: $k</td><td class=column3>Apex Central IOC: $t</td><td class=column4></td><td class=column6>Total: ".($k+$w)."</td></tr>");
print("");
print("</tbody></table> </div>
</div>
</div>
</div>");
print("</body></html>");
?>